Lecture 20+21 Lecturer: Aaron Roth Scribe: Aaron Roth
Total Page:16
File Type:pdf, Size:1020Kb
CIS 800/002 The Algorithmic Foundations of Data Privacy November f22, 29g, 2011 Lecture 20+21 Lecturer: Aaron Roth Scribe: Aaron Roth Differential Privacy and Mechanism Design In this lecture, we'll give a brief introduction to mechanism design, and see how differentially private mechanisms can be used as a building block in building truthful mechanisms. We'll start with the very simple example of a single item auction. Suppose an auctioneer has a single item for sale. Bidders i 2 [n] each have a private valuation for the item vi. If a bidder i wins the item, but must pay pi dollars, then his total utility is ui = vi − pi. Bidders are rational, and will act to maximize their utility. As mechanism designers, we get to design the auction rule to achieve some goal. Suppose we want to maximize social welfare: to allocate the item to the person who wants it the most. Consider the following simple auction rule: FirstPrice: 1. Each bidder i submits a bid bi. ∗ 2. i = arg maxi2[n] bi ∗ 3. Allocate the item to bidder i in exchange for payment pi∗ = bi∗ How should rational bidders behave? Its not clear... Example 1 Suppose n = 2 and v1 = 10, v2 = 4. Truthful bidding is not optimal: it results in 1 winning the item and getting utility u1 = 10 − 10 = 0. If 2 bids 4, then 1 should bid 4 + ... But 2 might also shade his bid.. What if they don't know each others value? As we see, it is not at all clear how agents will bid. Without knowing how the agents bid, we can't say anything about the performance of the mechanism! It allocates the item to the person who reported the highest value, but this might not be the person with the highest value... SecondPrice: 1. Each bidder i submits a bid bi. ∗ 2. i = arg maxi2[n] bi ∗ 3. i2 = arg maxi2[n]nfi∗g bi ∗ 4. Allocate the item to bidder i in exchange for payment p ∗ = b ∗ i i2 Unlike FirstPrice, it is always in each persons best interest to truthfully report bi = vi in secondprice. Write b−i to denote the set of all bids bj for j 6= i. n−1 0 Claim 1 For all i, b−i 2 R , bi 2 R: 0 ui(SecondPrice(bi; b−i)) ≥ ui(SecondPrice(bi; b−i)) Proof By case analysis We have just shown that SecondPrice is truthful or incentive compatible. It is always in each person's best interest to bid their true value. Therefore, because it allocates the item to the individual with the highest reported valuation, if agents are rational, it also succeeds in allocating the item with the highest true valuation, which was our objective. Of course, we needed to introduce payments to make the above mechanism truthful. What do we do if, as in many situations (elections, public works, organ transplants, ...) payments are not allowed? Lets now make some general definitions. 20+21-1 Definition 2 (The Environment) An environment is determined by: 1. A set N of n players. 2. A set of types Ti for each player i 2 N. (e.g. values vi in the auction setting) 3. A finite set S of social alternatives (e.g. allocations in the auction setting) 4. A set of reactions Ri for each player i 2 N. 5. A utility function ui : Ti × S × Ri ! [0; 1] for each agent i. We write T for Q T and t 2 T . Write r (t; s; R^ ) 2 arg max u (t; s; r) to denote i's optimal −i j6=i i −i −i i i r2R^i i reaction to type t and alternative s among choices R^i ⊆ Ri. A direct revelation mechanism M defines a game which is played as follows: 0 1. Each player i reports a type ti 2 Ti. 2. The mechanism chooses an alternative s 2 S and a subset of reactions for each player R^i ⊆ Ri. 3. Each player chooses a reaction ri 2 R^i and experiences utility ui(ti; s; ri). Agents play so as to maximize their own utility. Note that since there is no further interaction after the 3rd step, rational agents will pick ri = ri(ti; s; R^i), and so we can ignore this as a strategic step. Let Ri Qn Ri = 2 and let R = i=1 Ri. Then a mechanism is a randomized mapping M : T ! S × R. We 0 0 denote agents expected utilities for reporting a type ti when all other agents report type t−i as: 0 0 ^ ui(ti; M(ti; t−i)) = E ^ 0 0 [ui(ti; s; ri(ti; s; Ri))] s;Ri∼M(ti;t−i) We want to design mechanisms that incentivize truthful reporting. 0 Definition 3 A mechanism M is dominant strategy truthful if for all i 2 N, ti 2 Ti and t−i 2 T−i: 0 0 0 ui(ti; M(ti; t−i)) ≥ ui(ti; M(ti; t−i)) 0 It is strictly dominant strategy truthful if for each ti, there exists a t−i that makes the inequality strict. i.e. given a truthful mechanism, no rational agent ever has any incentive to lie about his type. We can also define an approximate version of truthfulness: Definition 4 A mechanism M is -approximately dominant strategy truthful if for all i 2 N, ti 2 Ti 0 and t−i 2 T−i: 0 0 0 ui(ti; M(ti; t−i)) ≥ ui(ti; M(ti; t−i)) − For an approximately truthful mechanism, agents may have incentive to lie, but the incentive is only very small. Note that it is very easy to design a mechanism that is truthful: we can merely ignore the reported types, and pick a random alternative s 2 S. But as mechanism designers, we will also have some objective that we wish to optimize { e.g. in the auction example, we wished to allocate the item to the person who desired it the most. A common objective is to maximize the social welfare F : T ×S ×R ! R defined to be: n 1 X F (t; s; r) = u (t ; s; r ) n i i i i=1 20+21-2 Definition 5 A mechanism M α-approximates an objective F if for all t: E ^ [F (t; s; r(t; s; R^))] ≥ max F (t; s; r) − α s;R∼M t;s;r Ok! Now we can set about designing mechanisms. We will focus on the social welfare objective, but nothing here will be specific to that. First lets consider unrestricted mechanisms that always output R^i = Ri for each player. As differential privacy aficionados, our first attempt at constructing a useful mechanism might be to select an alternative s 2 S from the exponential mechanism. Note that the social welfare objective is 1=n-sensitive, and so the exponential mechanism M(t) selects each s 2 S with probability proportional to: exp(nF (t; s; r(t; s)=2)). This mechanism is -differentially private, but what can we say about its incentive properties? Call a mechanism non-imposing if it always outputs R^i = Ri. Such a mechanism is a mapping M : T ! S. Theorem 6 For any ≤ 1, a non-imposing mechanism that is -differentially private is 2 approximately truthful. 0 Proof Fix any -differentially private mechanism M : T ! S. For any i, ti, t−i we have: 0 u (t ; M(t ; t )) = E 0 [u (t ; s)] i i i −i s∼M(ti;t−i) i i X 0 = Pr[M(ti; t−i) = s]ui(ti; s) s2S X 0 0 ≥ exp(−)P r[M(ti; t−i) = s]ui(ti; s) s2S 0 0 = exp(−)ui(ti; M(ti; t−i)) 0 0 ≥ ui(ti; M(ti; t−i)) − 2 Of course we also know that the exponential mechanism is pretty accurate as well. Translating our utility theorem for the exponential mechanism: Theorem 7 M α-approximates the social welfare F for: 1 α = O (log jSj) n So this is pretty good already! We have a generic method of designing approximately truthful mechanisms with good utility guarantees (if n is large enough) for arbitrary type spaces and objective functions! This is something that does not exist in the mechanism design literature for exact truthfulness. On the other hand, we might want to do better.. Recall, why did we want truthfulness in the first place? It was because we wanted to guarantee that optimizing over reported types was as good as optimizing over true types. But if the mechanism is only approximately truthful, how do we know that the reported types are the true types? Why shouldn't agents take their incentive to lie, however small? If we are to be satisfied with approximate truthfulness, we need further to assume that agents will not lie if given only a small incentive. Perhaps mis-reporting has some small external cost (guilt?), or perhaps the beneficial lie is difficult to find. In such cases, perhaps we can stop here. But in other cases, we would like an exactly truthful mechanism. The idea will be to randomize between a differentially private mechanism with good social welfare properties (i.e. the exponential mechanism), and a strictly truthful mechanism which punishes false reporting but which has poor social welfare properties. If we mix correctly, then we will get an exactly truthful mechanism with reasonable social welfare guarantees. Here is one such punishing mechanism which is simple, but not necessarily the best for a given problem: 20+21-3 P 0 Definition 8 The commitment mechanism M (t ) selects s 2 S uniformly at random and sets R^i = 0 fri(ti; s; Ri)g.